Contents (7)
On 20 October 2026 the PHP security team published a short but unusual notice: a security release is coming that fixes two critical vulnerabilities, each rated 9.2 on CVSS v4.0. It was scheduled for Wednesday 21 October at 14:00 UTC.
Advance notice for a PHP security fix is rare. Security releases usually ship quietly in the regular cycle. When the security team announces one ahead of time and asks everyone to “prepare now”, they consider these bugs serious and want the gap between the fix and server updates to be as short as possible.
What we know so far
- Two critical vulnerabilities, both rated CVSS v4.0 9.2.
- Release time: 21 October 2026, 14:00 UTC.
- The PHP team said it may release earlier if details become public or if there is evidence of active exploitation.
- Technical details, affected versions and fixed versions are published with the release.
This note was written before the details were published. Once the new versions ship, the exact fixed versions and CVE IDs appear in the php.net news and the ChangeLog. Check there which version your branch has reached.
Branches that currently receive security fixes
According to php.net’s official table, these branches receive security fixes today:
- PHP 8.5: active support until the end of 2027
- PHP 8.4: active support until the end of 2026
- PHP 8.3: security fixes only, until the end of 2027
- PHP 8.2: security fixes only, until 31 December 2026, which is less than ten weeks away
If your server still runs PHP 8.1 or older, there is no official release for you. That is the best reason to schedule the upgrade this week.
Before the release: get ready
- Find the exact PHP version. In WordPress, check Tools › Site Health › Info › Server, or run
php -vin a terminal. The command-line PHP and the version your web server runs (PHP-FPM) sometimes differ. - Know who updates PHP. On shared hosting it is the host. Open a ticket today and ask when they will install the fix. On a dedicated server or VPS, it is you.
- Know where your packages come from. Distribution repositories may ship the fix with some delay. Repositories such as ondrej/php on Ubuntu or Remi on RHEL usually ship sooner. Docker’s
phpimage is updated too, but only takes effect when you rebuild. - Take a backup, of files and the database. A patch release rarely breaks anything, but “rarely” is not good enough for a store taking orders.
- Pick a low-traffic window to restart PHP-FPM.
After the release: update
On Ubuntu or Debian with the ondrej repository, the usual path is (replace the version with yours):
sudo apt update
apt list --upgradable 2>/dev/null | grep php
sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm
php -vOn RHEL or Alma with Remi:
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm
php -vIn Docker, pull the image and rebuild the service; restarting the container is not enough:
docker compose pull && docker compose up -d --buildAfter updating: check that it really happened
- Read the version from the web server, not just the command line. WordPress Site Health shows exactly that.
- Don’t forget OPcache. If PHP-FPM is not restarted, old workers keep running the previous binary.
- Test the sensitive paths by hand once: login, a test payment, the contact form, and any cron job or webhook connected to a gateway or warehouse.
- Watch the PHP error log for 24 hours. Security bugs are sometimes closed by changing behaviour in edge cases, and a plugin that relied on that behaviour may now warn.
Why this one is more serious
Patchstack’s State of WordPress Security in 2026 reports that about half of high-impact vulnerabilities are exploited within the first 24 hours. That figure is about plugins, not PHP itself, but the logic carries over. Once a fix ships, the code changes are public too, and attackers read them to find the bug. The time from “fix released” to “exploit available” gets shorter every year.
So if you do only one thing from this note: find out today who updates your server’s PHP, and when.
Sources
$ ./request_review
Facing the same problem in your own store?
Senior WordPress and WooCommerce backend engineering for complex production problems.
Request a Technical Assessment
## Comments